CWE-333: Improper Handling of Insufficient Entropy in TRNG
Description
True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
The rate at which true random numbers can be generated is limited. It is important that one uses them only when they are needed for security.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Low
- Status
- Draft
Common consequences
- Availability
DoS: Crash, Exit, or Restart
A program may crash or block if it runs out of random numbers.
Potential mitigations
- Implementation
Rather than failing on a lack of random numbers, it is often preferable to wait for more numbers to be created.
Related weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.